Authorization/Token URL overrides are ignored when the server exposes no OAuth metadata #2562

Which version line?

v2 — current (@modelcontextprotocol/inspector@latest)

Which client?

Web

Inspector version

2.9.0

Node version

v26.8.2

Operating system (and browser, for the web client)

macOS 26

Transport

Streamable HTTP

MCP server under inspection

Server: @modelcontextprotocol/inspector
Protocol Era: legacy
oAuth: Yes

{
"mcpServers": {
"dev-server": {
"type": "streamable-http",
"url": "https:////mcp",
"headers": {
"Ocp-Apim-Subscription-Key": ""
},
"oauth": {
"clientId": "",
"scopes": "api:///",
"authorizationUrl": "https://login.microsoftonline.com//oauth2/v2.0/authorize",
"tokenUrl": "https://login.microsoftonline.com//oauth2/v2.0/token"
}
}
}
}

Steps to reproduce

1. Run npx @modelcontextprotocol/inspector
2. Add a Streamable HTTP server whose host serves no OAuth discovery metadata and returns 401 for unauthenticated requests.
3. In the server's OAuth settings, set Client ID, Scopes, Authorization URL override, and Token URL override to an external authorization server (Entra ID).
4. Click Clear stored OAuth state, restart the Inspector, and connect.

Expected behavior

The browser is redirected to the configured authorization URL override:
https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize?...

Actual behavior

The browser is redirected to the fallback endpoint on the MCP server's host:

https:///authorize?response_type=code&client_id=&code_challenge=...&code_challenge_method=S256&redirect_uri=http%3A%2F%2F127.0.0.1%3A6274%2Foauth%2Fcallback&state=...&scope=api%3A%2F%2F%2F

The client ID and scope from the server entry are applied (they appear in the request), but both endpoint overrides are ignored.

Logs, errors, or screenshots

No response

Already prototyped a fix?

No response

Before you submit

• I searched existing issues and this is not a duplicate.
• This is not a security vulnerability report (those go through the private advisory process).